I decompiled a C++ exe file using Snowman, hoping to see if it was malware or not (Although, honestly, I have no clue how to continue that - The file is really large, and the decompilation mostly gibberish)
It resulted in a pretty big chunk of code, most of which obviously had no proper variables names attributed to it anymore; Instead, variables and functions were either named like the assembly registers they belong to, or by some hex name, or by some number/char combination that did not particularly look like hex.
However, part of the code somehow still had proper names, although they all seemed to be system functions: DrawRect, RegCreateKeyExA, DefWindowProcA, SHBrowseForFolderA, and so on - plenty of calls that seem to interact with the system.
Does that mean that the decompilation preserved Windows system calls, but not the names of functions/variables created by the developer of the file? If so, what should I do next to be able to see whether the file could have malicious intent or not?
It might also be noteworthy to say that the file I'm looking at is a Nullsoft Installer - So technically, a lot of the decompiled code is just overhead, when I actually want to look at what it installs and not the installer itself.